IN THE CLAIMS 



Amended Claims follow; 

I ( )hc\ ious!\ Predated) A computer program ptoduct m a computer Mosaic 
medium computing a computer piogrum operable to coultoi a computer to detect a 
known computet program w tthm a packed computet file said packed computes hie being 
unpacked upon esecutton said computer program eonipmmg 

tcsouice data reading iocie for loading tesouiee data wstfun said packed computet 
Hie said tesouue data opeciKmg program icsoutee iterm used In said known compute i 
piogium and tradable hv a computer opetuttng -ystem without dependence upon which 
unpacking aigonthm is it^ed b\ said packed computet Ale, and 

tesoiiKC data eompatuiii logic tot generating eiuiu.ctt.mtK? of satd lesomce data 
and Km comparing >aid chataaeristics of said icsouice data with characteristic-, of known 
computet piogtum redout ce dat i and foi detecting a match w tth said known computer 
piogiam iiidii_am y o{ said packed computet ide containing ->ard known computet 
program; 

whet (.-in said resource aata of said packed computer tile it. pKxvssed to venerate 
fmgeipimt data aud to compaie said generated firtgetpnnt data w tth 1 now n computet 
program tinge rprmt data; 

whcicin said generated fingerprint data includes, a number of program icsoukc 
items specified withm said resource data of said packed computei file 

whet em said geneiated firu>erptirit data includes a flag indicating which data io 
included wuhsn satd geneiated fmgetprmt data 

wherein said geneiated fiugetptmt data includes a location within sard tesource 
data of said packed computer file of an entry specifying a program resource item ha ving a 
largest size; 



- 3 - 

wherein said generated fingerprint data includes a checksum value calculated m 

dependence upon: 

a number of said program resource items specified beneath each node within 

hierarchically arranged resource data of said packed computer file; 

string names associated with said program resource items within said resource 
data of said packed computer file; and 

sizes of said program resource items within said resource data of said packed 

computer file, 

2. (Original) A computer program product as claimed in claim I, wherein said 
known computer program is one of: 

a Trojan computer program; and 

a worm computer program. 

3. (C urremh Amended} A computer ptogiam puuluct as claimed m claim 1 , 
vxheiein said resouiee d a ta - of -M wd j » ae^l - cH + ;^ » utef 4 * k ? comparing logic is operable to 
compare said tesource data »f said packed computer file with characteristics of a pluralitv 
of known computet ptuc'wjms to detect if said packed compute! [[pjogiam] jtiic' contains 
one of said pluiahu of known computet piogiamv 

4. (Cancelled) 

5. (Original) A computer program product as claimed in claim L wherein said 
program resource items used by said known computer program include one or more of: 

icon data: 

string data; 

dialog data; 
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hitenap data; 
menu data; and 
language data, 

6. (Previously iPresented) A computer program product as claimed in claim I, 
wherein said resource data of said packed computer file specifies for each resource item a 
storage location of said resource item. 

?. (Original) A computer program product as claimed in claim 6. wherein said 
storage location of said resource item is specified as an relative offset value. 

X tPie\u>ush PKsemed) \ compute! progiam ptoduu as daimed m daim 1 
\\he?em s<nd ie->ouice data of said packed eo upiuei file specifies foi each icsonice ueni a 
size of said resource item. 

9.-1 L (Cancelled) 

1 2 { Pre\ iuusK Ptesemed) A computer piogram product as claimed in claim I . 
wherein said geneuued fingvrpimt data includes timestamp data indicathe of a time of 
compilation of said known compute! program 

13. (Cancelled) 

14. (Previously Presented) A computer program product as claimed in claim 1 , 
wherein said checksum value is rotated between each item being added into said 
checksum. 
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15. (Original) A computer program product as claimed in claim i, wherein said 
packed computer fife include 1 * an unp.iv.kjng computet piogiam \\ hich upon execution 
decomposes said known computet pi obtain 

16 {Ottgmai} A compute! program ptoduct as claimed m claim 1, vUieicm ^aid 
packed computet file js a \\ m^2 l'F file 

17 {PrcMotiaK Piesemed) A compute! piogiam piuduct tn a computet Motage 
medmm compjiMJia a compute! piogiam opaable to eonttoi a computer to at net ate data 
fbt detecting a known computer progtam within a packed computet flic said packed 
compute! hie being unpacked upon execution, said computet piogt am comptimig 

lesotuee data reading logic for leading resouice data within said packed computet 
file said tesource data specifying piogiam tesouiec Hom-> used h\ ,->atd known computet 
piogtam at id icadable b\ a compute! updating ,-vMem without dependence upon which 
unpacking algorithm ic used b\ said packed compute) file, and 

chataaemtu. data generating logic tot generating chaiactensiit. data associated 
with said tesouiee data lot companion with chatactensuc data oi known coniputei 
piogiam te^outce data to detect a match with said known compute! progtam indicative of 
said packed computet file containing said known compute! piogiam, 

wheiein said tesource dataofsasd packed computet tile is pi needed to geneiate 
fnigetpimt data and to compate satd getietateci fmgetpttnt data wtth known computet 
program fingerprint, data: 

whet em said generated fmgeiptmt data includes a ntimbet of piogiam room to 
items specified w ithin satd ie>omce data of said packed computet fdc 

wheiem said genes ated fuigeiptint data includes a ilag indicating which data is 
included within said genetated fmgetpimt data 
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u herein sard generated fingerprint data includes a location within <>aid resource 
data oi' ->aid packed computer ule oi an entry spetifs mg a program icsouicc item ha\ mg a 

largest size; 

wherein said generated fingerprint data includes a checksum value calculated in 
dependence upon; 

a number of program resource items specified beneath each node within 
hierarchically arranged resource data of said packed computer file; 

string names associated with program resource items within said resource data of 
said packed computer file; and 

sizes of program resource items within said resource d ata of said packed computer 

file. 

18. (Original) A computer program product as claimed in claim 17, wherein said 
known computer program is one of: 

a Trojan computer program; and 

a worm computer program. 

i<> (Curtemh Vmcndcd) \ computer piugutm product as claimed in claim 1" 
uhetesu said ciiaiaaenstK data generating h gie f$ opuabie to genet ate characteristic 
data trom a plurahts of known computes programs to unable detection of am of vud 
plinalitv of known computer programs \wtbm s.ud packed computer |[ptogiaro]]file 

20. (Cancelled) 

2 1 . (Original) A computer program product as claimed in claim 1 7, wherein said 
program resource items used by said known computer program include one or more of: 

icon data; 
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string data; 
dialog data: 
bitmap data; 
menu data; and 
language data . 

22, (Previously Presented) A computer program product as claimed in claim 1 7, 
wherein said resource data of said packed computer file specifies for each resource item a 
storage location of said resource item. 

23. (Original) A computer program product as claimed in. claim 22, wherein said 
storage location of said resource item is specified as an relative offset value, 

24, (Previously Presented) A computer program product as claimed in claim 17, 
wherein said resource data of said packed computer file specifies for each resource item a 
size of said resource item. 

25. -27. (Cancelled) 

2i\ fPtewnusK Pic°ented> \ computet ptoaram paxiuct as claimed m claim l 7 , 
uheiem vttd geueiated fmiicipnnt data includes ame-iamp data mdicatn e of a tune of 
compilation of said known computes pumran 



29. (Cancelled) 



W (}hc\ iousK Pi evented) A computer ptogram pioduct as damied in claim 1 7 
wheiem ->aid checksum saluc ts rotated betw Jen each item beint* added mto said 

checksum. 



3 i , (Original) A computer program product as claimed in claim 1 7, wherein said 
packed computet file include-, an unpacking compute! program wfudi upon execution 
decomposes said known computer piogram 

-2 {< )iiy!iia!) \ computet ptogtam product as claimed in claim 17, uhetetn scud 
packed compute! file is a W iu32 Pk file 

3 > {PtewousK Ptesented) A method of controlling a computer to detect a known 
computet ptoiriam \\ ithm a packed computet file said packed computer file being 
unpacked upon oeeuuon, satd method compr jt>mg the step-> ot 

readme fesouice data v. itlun said packed computer file, said icsouice data 
«pec it\ ui" pto^tam le&otuce item.; used b\ s\-nd known computet piogiam and teadable 
In a computet operating sx^tem without dependence upon which unpacking algorithm l- 
used b\ saui packed tomputei lile and 

genetatmg chatactetimcs of oafd tescuicc data and competing satd diat aeteitsttes 
of said icsouice data with chataaemtics uf known compute! ptogtam tesomce data and 
detecting a match with diataeteiis-ttes ofsaul known computet ptogtam ituhcatne of said 
packed computet file containing satd known computei ptogtam 

w herein satd resomce data of said packed computet file ts processed to yenetate 
finget print data and to compare -Mid geneiated fmgtripnnt data w nh known computei 
ptogiam fingerprint data, 

whetem >a\d geneiated ftngerpt uu data includes a numbei oi ptogram lestmrcc 
items specified v. ithm said recotuce data (.if said packed computei file. 
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w herein said geneiaied fmgeipimt data includes a ilas indicating which daia is 
included within aaid generated fmgeipimt data, 

wherein >a\d genet ated fuigeiptim daia includes <j location withm said tesouice 
data of said packed computes file of an entn specifying a piogiam tesouree item lunmg a 
largest size; 

w herein said geneuited fmgeipimt data includes a checksum value calculated in 

dependence upon: 

a number of program resource items specified beneath each node within 
hierarchically arranged resource data of said packed computer file; 

string names associated with program resource items within said resource data of 
said packed computer file; and 

sizes of program resource items within said resource data of said packed computer 

file. 

34. (Original) A method as claimed in claim 33, wherein said known computer 
program is one of: 

a Trojan computer program; and 

a worm computer program, 

35. (C'unemh Amended) A method as claimed in claim 33, wherein saul step of 
comparing compares said resource data of said packed computer file v. ith characteristics 
of a plurality of known computet progtams to detect if said packed computer 

| [program]] file contains one of said plurality or know n computer programs 



36. (Cancelled) 
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^ (Oumnal 1 V method as i. tanned in claim > * w heicm said ptogram resource 
items used said knonu computer piugiam include one or mote 01 

icon data; 

string data; 

dialog data; 

bitmap data; 

menu data; and 

language data. 

38. (Previously Presented) A method as claimed in claim 33, wherein said 
resource data of said packed computer file specifies for each resource item a storage 
location of said resource item. 

V->. (Original) A method as claimed in claim 38, wherein said storage location of 
said resource item is specified as an relative offset value. 

40. (Previously Presented) A method as claimed in claim 33, wherein said 
resource data of said packed computer file specifies for each resource item a size of said 
resource item. 

41. -43. (Cancelled) 

44 (PrewousK Presented) A method as claimed m claim 33, wherein said 
generated fingefpnm data uk hides ttmestdmp data indicative of a tune of compilation of 
said known computer program. 



45. (Cancelled) 

46. (Previously Presented) A method as claimed in claim 33, wherein said 
checksum value is rotated between each item being added into said checksum. 

4". (Original} A method as claimed in claim 33, wherein said packed computer 
file includes an unpacking computer program which upon c\ceution decompresses said 
known computer program. 

48. (Original) A method as claimed in claim 33, wherein said packed computer 
file is a Win32 PE file. 

I 1 ' {Piewoush Piescnted) A method of eonuollmg a computei to geneiatc data 
tor detecting a known computei ptugnim w ithm a packed computei file, sasd packed 
computei tile being unpacked upon execution said method cornpiisiny the step^ of 

reading tesouice data w tihm said pacved eompiuer file, said tesouice data 
specify tngptogi am ie so nice items used h\ said known computei ptogtam and leadable 
b\ a computei opetatmi! sxateiu without dependence upon which unpacking algonthm is 
used In said packed computet Hie and 

geneiatmg chatacteu^uc data a^soeiared w ith said resource data tor compatison 
with chatacietiMic data of known computet ptoyiam lesomee data and detecting a match 
with said known computei piegiam mdicame of said packed computei file containing 
said known computer program; 

wherein said resomee data of said packed computei file is processed i<"> geneuue 
fingerprint data and t(> compare ^atd geneiated thigc-ipnnt data w ith known computei 
piogtatn Fmgerpimt data, 

whciem said tienetatcd Itngetpntu data includes a numbet ol piogtatn tesource 
items specified wnhm said reoomce data of said packed compute! file. 
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w herein said geneiaied fmgeipimt data includes a ilas indicating which daia is 
included within aaid geneiated fmgeipiim data, 

wheiem ?.aid genes ated lingeipnnt daia includes <j location withm said fe.soince 
data of said packed computes file of an entn specifying a piogiam tesouree item inning a 
largest size; 

w herein said gencuited fmgeipimt data includes a checksum value calculated in 

dependence upon: 

a number of program resource items specified beneath each node within 
hierarchically arranged resource data of said packed computer file; 

string names associated with program resource items within said resource data of 
said packed computer file; and 

sizes of program resource items within said resource data of said packed computer 

file. 

50. (Original) A method as claimed in claim 49, wherein said known computer 
program is one of: 

a Trojan computer program; and 

a worm computer program, 

51 {{ tuienth Amended) A method as claimed in claim 4°, w heiem saul step of 
geneiattng geneiato chaiacteriotK data ft cm a pluialia of known computet piograms to 
enable detection of am of said pknalstx of known compuk'T piogtams withm said packed 
co mp uter [ [program] ] file . 



52. (Cancelled) 
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5 > (Ouemal) V method as damicd m claim 49 whejem said piogram icsuuiee 
items used b\ said knonu computer piutiiam include one or mote oi 

scon data; 

string data; 

dialog data; 

bitmap data; 

menu data; and 

language data. 

54 f^Pa-MOusK Presented) -\ method as claimed m claim 49, uhuem 
1 esouit e data oi said packed >. omputoi fdc spec ifie> fot each m>outee item a storage 
loc.it ion of said lesource item 

55. (Original ) A method as claimed in claim 54, wherein said storage location of 
said resource item is specified as an relative offset value. 

56. (Previously Presented) A method as claimed in claim 49, wherein said 
resource data of said packed computer file specifies for each resource item a size of said 
resource item. 



57.-59. (Cancelled) 



f'O (PiewousK Presented) A method as claimed m claim 49, wherein said 
generated fingefpnm daia m<. hides tunestdmp data indicative of a time of compilation of 
said known computer program. 
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61. (Cancelled) 

62. (Previously Presented) A method as claimed in claim 49, wherein said 
checksum value is rotated between each item being added into said checksum. 

6.v (Original} A method as claimed in claim 4^, wherein said packed computer 
file includes an unpacking computer program which upon execution decompresses said 
known computer program. 

64. (Original) A method as claimed in claim 49, wherein said packed computer 
file is a Win32 PE file. 

6^ {Piewoush Pitscnfed) Appaidtus foi detecting a known computet program 
within a packed computet tile said packed computer fik beins> unpacked upon execution 
said apparatus comprising: 

a tesouite data readu tot reading tesouice data wuhtn sard packed computet file, 
said resctuee data specifying ptogiam lesoutv-e Hems used bv sard known computet 
pingiam and readable b\ a computet opesating system without dependence upon which 
unpacking algoiuhm is used bv said packed computet fife, and 

a resouuc data compatator for genetaung chaiactemtics of said tesouree data and 
lot iwOmpaiiog said chataaerssUcs of said tes mice data v\ »h chaiaetei f&tfcs of known 
comptuei program haoukc data fot detecting a match with said known computet 
piogram indicati\c of said packed computer file containing said known computer 
program; 

wherem said resomee data of sard packed compute) file is ptotested to generate 
ftngerpnnf data and to compare said generated fingerprint data with known computer 
program fingerprint data; 



wherein said genet ated fmgeipimt data includes a numbei of ptogtam resoiuce 
items specified withm satd iesource data of said packed compute! file 

wherein said generated fingerprint daia includes a (lag indicating vdnch data is 
included within said geneiated fmgeipimt data 

whet em said geneiated fingerprint data includes a location wtthm said resource 
data o} said packed computer file of an entiv speahmg a progtam icsouice item has trig a 

largest size; 

wherein said generated fingerprint data includes a checksum \alue calculated 111 
dependence upon; 

a numbei of program lesomce items specified beneath each node within 
lueiafchicalh at tanged resolute data oi said packed computet file, 

stung names associated wnb piogtam te^-owce item-- within „>aul ie*-omce data of 
said packed compute! file, and 

j>i/cs of ptogram lesouice items w ulun said re^ouice data of #ajd packed computet 

file. 

60 (Original) \ppaiatu$ as claimed in claim (A w herein said known computet 
program is one of 

a Itojan computet piogtam, and 

a worm computer program. 

<i? (.('uircuth Amended) Apparatus as claimed 111 claim o5 w heicin said icsonree 
data comparatot is operable to eompare said resoiiice data of Mid packed uunputer file 
with chat actor tstics of a piurahix of known compute! piogiams 10 detect if said packed 
computer 1 1 piogiam | jjjje contains one of said plutalm of know n computet progtanis 



68. (Cancelled) 
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69. (Original) Apparatus as claimed in claim 65, wherein said program resource 
items used by said known computer program include one or more of 

icon data; 

suing data; 

dialog data; 

bitmap data; 

menu data; and 

language data. 

"0 (Ptc-\iou$K Presented) Vpparattio as claimed in claim <>\ wK-iem said 
iesouice data of^aid packed computer file specifies tot cmlIi Tesouti_e Hem a sum age 
location of said u-souree item 

71 . (Original) Apparatus as claimed in claim 70, wherein said storage location of 
said resource item is specified as an relative offset value. 

72. (Previously Presented) Apparatus as claimed, in claim 65, wherein said 
resource data of said packed computer file specifies for each resource item a size of said 
resource mm, 

73. -75. (Cancelled) 

"o tPu-uoush Presented) Vppatattio as claimed in claim <>^ wheicm said 
generated iingerpiins data includes tunestamp data indicative of a tune of compilation of 
«aid known Lomputei progs am 
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77. (Cancelled) 

78. (Previously Presented) Apparatus as claimed in claim 65, wherein said 
checksum value is rotated between each item being added into said checksum. 

79. (Original) Apparatus as claimed in claim 65, wherein said packed computer 
file includes an unpacking computer program which upon execution decompresses said 
known computer program. 

SO. (Original) Apparatus as claimed in claim 65, wherein said packed computer 
tile is a Win32 PE file. 

81 (PieviousK Ptepented) App.n<nus foi geneiatnig data iot detecting a known 
compute! piogiam w ithin a packed compute! tiie said packed computer file being 
unpacked upon execution, \atd appaiatus computing 

a lesuurce data leadei iot leadmg tesourcj data \uthtn said packed computes file, 
saidtesouue data specinmg ptogram icsouice items used hs said known computet 
piogjant and readable in a computet openunig system without dependence upon winch 
unpacking algonthm is ovd b\ said packed computet tiie. and 

achaiatteriotit data guteiatot tbi generating ehatacteustsc data associated with 
said resouiee data fot eompaitsou with cbaiactetMie data of known computet ptogtam 
ic^ource data and tor detecting a match with said known compute* piogiam mdkati\e of 
saul packed compute! file containing said Itvwn computet piogiam 

wherein said reroute e data of said packed computet file is ptocessed to genet ate 
fingei print data and to compare -utd gcneiatcd fingei punt data \\ sth known computei 
program fingerprint data; 



-18- 



u herein said geneiated fingeipimt data includes a numbei of piogtairi resoiucc 
items specified within satd iesouice data of said packed compute! file 

wheiem >n\d geneiated fingeiptuu data includes a llag indicating which data is 
included withm said geneiated fmgeipimt data 

whet em said geneiated fmgcipunr data includes a location withm said tesouiee 
data o} said packed computer file of an enttv speahmg a piogtam icscuuce uem has nig a 

largest size; 

wheiem said genes ated Itngetptint data includes a chetk-nim \alue calculated hi 
dependence upon; 

a numbt'i of progiani lesomce items jpeufied beneath each node within 
liieiaierucalh at tanged iesouice data oi said packed computet fde, 

stnng names associated wuh ptogtam te--ouTce item*- within „>aul te-omee data of 
said packed compute! file, and 

m/cs of piogtam tesouice items v, nlun said je^ouice data of said packed computet 

file. 

82. (Original) Apparatus as claimed in claim 8i, wherein said known computer 
program is one of: 

a Trojan computer program; and 

a worm computer program. 

8^ f^CuireutK Amended) Appawuns as claimed in claim 8 ! w heiem satd 
charauujstj*. data genetatot is opeiable to gtneiate charauesisue data fiom a plutalii\ of 
known computet psogiams to enable detection of am of said plmahtv of known 
compute! pi octants v\uhm said packed uMiiputei [[piogiainjlfik. 



84. (Cancelled) 
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85 fOikinal) Apparatus ;ic claimed m ciaim SI , v\ heiem said piogram resource 
items used b\ said known computer punuam include one ot mote nl 

icon data; 

suing data; 

dialog data; 

bitmap data; 

menu data; and 

language data. 

80 (FteMOusK Presented) Vppatatiio as claimed in claim 81, whvicin said 
iesouice data oi"»aid packed compute! file specifies tot eai_h H\souti_e item a sfMage 
location of said u-souree item 

87. (Original) Apparatus as claimed in claim 86, wherein said storage location of 
said resource item is specified as an relative offset value. 

88. (Previously Presented) Apparatus as claimed, in claim 81, wherein said 
resource for each resource item a size of said resource item, data of said packed computer 
file specifies 

89. -91. (Cancelled) 



92 tPu-uoush Presented) \ppatattic> as claimed in claim 81 whvicin said 
generated iingerpttm data includes timestanip data indicative of a time of eomju latum of 
«aid known Lomputei progs am 
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93. (Cancelled) 

94. (Previously Presented) Apparatus as claimed in claim 81, wherein said 
checksum value is rotated between each item being added into said checksum. 

95. (Original) Apparatus as claimed in claim 81, wherein said packed computer 
file includes an unpacking computer program which upon execution decompresses said 
known computer program. 

96. (Original) Apparatus as claimed in claim 81, wherein said packed computer 
tile is a Win32 PE file. 



97. (Cancelled) 



